a35841201479faebbec8b874ab6a4712

General

Target

a35841201479faebbec8b874ab6a4712
Size

70KB
MD5

a35841201479faebbec8b874ab6a4712
SHA1

da2abbba988cec10257c094140f6339915b502dd
SHA256

8c9329de0b5e4d0cc5b1950b05ee03cdef63aba3b577c7165883622b6ec7cb18
SHA512

7a4adcdb2a8cf7decc2cefe7849432f8e512bcbb6105c7d34703e353ce107a22ff52a2db87e88c6b87a4977835c7f3555ecc1df05ecdb4d361263226c88f3d9a
SSDEEP

1536:U0vRcIR34hj/QjKzJZC1lECQBZs1qLZNyl3WaXq+ysqZ:U0vbx4hDQjKz3W3QPs1+AXq+ysqZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a35841201479faebbec8b874ab6a4712

Files

a35841201479faebbec8b874ab6a4712
.dll windows:5 windows x86 arch:x86

f1ee9dcd6658846ff4ff423a68e9422d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
FreeLibrary
GetCurrentProcess
Process32First
LoadLibraryW
Process32Next
GetProcAddress
GetVersionExA
CloseHandle
IsWow64Process
GlobalFree
CreateToolhelp32Snapshot
SetLastError
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
GetLastError
HeapFree
HeapAlloc
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
Sleep
HeapSize
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
WriteFile
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges

Exports

Exports

function1
function11
function12
function13
function2

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f1ee9dcd6658846ff4ff423a68e9422d

Headers

File Characteristics

Imports

kernel32

advapi32

Exports

Exports

Sections

.text Size: 45KB - Virtual size: 45KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 3KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 45KB - Virtual size: 45KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 3KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 6KB - Virtual size: 6KB